Unable to perform aggregation on 2 fields


#1

I am trying to find a unique count on a pair of source and destination IPs in my stored records.
In elastic search, the mapping shows that the fields are being stored as an IP type, however when I try to compare the 2 IPs, to sort them, Elasticsearch throws an error, saying

"Cannot apply [>] operation to types [org.elasticsearch.index.mapper.IpFieldMapper.IpFieldType.IpScriptDocValues] and [org.elasticsearch.index.mapper.IpFieldMapper.IpFieldType.IpScriptDocValues]." 

The reason I want to do this is because in some records in which the same IPs are stored, however in different srcIP and dstIP fields. I would like to eventually create a visualization based on the top 10 pairs but to do that, I must first try to figure this out.

Do you guys have any suggestions? This is my query so far... It's a little messy:

"aggs" : {
	"ip_pairs" : {
		"cardinality" : { 
			"script" : "if (doc['srcIP'] > doc['dstIP']) { doc['dstIP'].value + '-' + doc['srcIP'].value } else { doc['srcIP'].value + '-' + doc['dstIP'].value }"
		}

	}
}

(Xavier Facq) #2

Maybe should you look at the available methods in the class corresponding to the error?

IpScriptDocValues

(system) #3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.